Cisco Foundation AI has released Antares, a family of small language models designed to locate known software vulnerabilities within specific codebases.
The release includes two open-weight versions, Antares-350M and Antares-1B, available on Hugging Face under an Apache 2.0 license. Cisco also published the Vulnerability Localization Benchmark (VLoc Bench), a suite of 500 tasks for evaluation, under the same terms.
The primary finding is that a 1B parameter model achieves a File F1 score of 0.209. This outperforms GPT-5.5, which scores 0.229, and a 753B open-weight model, which scores 0.186.
Scope and limitations
Software security relies on linking external vulnerability data to internal source code. This data exists in public databases and advisories, while the code resides in large, modular repositories.
Connecting these two elements is expensive. Developers must search unfamiliar code, follow naming conventions, inspect call paths, and compare candidate files. Cisco states that this initial triage step concentrates the majority of the cost.
Antares does not replace the existing application security toolchain. Teams still require dependency scanning, secret scanning, dynamic testing, container checks, threat modeling, and expert review.
Model architecture
Antares consists of three decoder-only transformers with 350M, 1B, and 3B parameters. All three models initialize from IBM Granite 4.0 checkpoints. They share a tokenizer and architecture, including grouped-query attention, SwiGLU MLPs, RMSNorm, RoPE, and shared input/output embeddings.
| Model | Params | Base checkpoint | Context | Layers / hidden / KV heads | Status |
|---|---|---|---|---|---|
| Antares-350M | 350M | Granite 4.0 350M | 32K | 28 / 1024 / 4 | Open weights |
| Antares-1B | 1.6B | Granite 4.0 1B | 128K | 40 / 2048 / 4 | Open weights |
| Antares-3B | 3B | Granite 4.0 Micro | 128K | Not published | Not released |
The agent loop
Antares is not evaluated as a standalone sequence model. It runs inside a constrained loop with three tools.
The model receives a CWE category description and nothing else. No advisory text, no file hints, and no severity details are provided. It then issues read-only terminal commands against a Docker sandbox with networking disabled. Command output is truncated to 2,000 characters before entering the transcript.
The budget allows 15 terminal calls per task. The model terminates by calling submit_vulnerable_files with a ranked list, or submit_no_vulnerability_found. The submission itself does not count against the budget.
Output is a ranked list of file paths plus the exploration trace that produced it.
Benchmark details
VLoc Bench draws 500 tasks from 290 unique real-world repositories. Sources are public GitHub Security Advisories across six ecosystems: npm, pip, Maven, Go, Rust, and Composer. It covers 147 unique CWE categories, and 78% of entries carry assigned CVE identifiers.
Ground truth is derived from the security patch. Files modified in the fix are labels, with tests, docs, and configuration excluded.
The benchmark has two phases:
- Phase A gives the model the vulnerable snapshot and scores File F1.
- Phase B gives the patched snapshot and scores True Negative Rate, testing whether the model raises a false alarm on fixed code.
Performance results
The pattern in the data is a capability cliff, not a scaling curve.
Antares-3B reaches 0.223 File F1, just under GPT-5.5 (xhigh) at 0.229. Antares-1B reaches 0.209, above GLM-5.2 at 753B parameters, which scores 0.186. Antares-350M reaches 0.135, above Gemma-4-31B at 0.101 and Gemini 2.5 Flash at 0.102.
Antares-1B also records the highest recall of any evaluated system at 0.224.
Static analysis tools were run under the same evaluation. Semgrep scores 0.086 File F1, CodeQL scores 0.023, and Horusec scores 0.020. Cisco’s reading is that rule-based scanners recover some vulnerable files but cannot adaptively inspect repository context.
Training methodology
The untrained Granite 4.0 base checkpoints score 0.001, 0.000, and 0.000 File F1 under the identical protocol. They have tool-calling ability and still produce degenerate output inside an agentic loop.
Supervised fine-tuning does the heavy lifting. It lifts the three scales to 0.108, 0.188, and 0.198. The SFT corpus is 71.5% cybersecurity reasoning, 15.4% code search trajectories, and 13.1% deep research and general reasoning. All reasoning traces come from a single teacher, GPT-OSS-120B, to avoid cross-teacher distribution shift.
GRPO then adds 11% to 25%, with the largest relative gain at 350M. Rewards are verifiable and computed programmatically from trajectory text, with no learned reward model. Components cover localization quality, submission behavior, tool-use compliance, exploration, and malformed-output penalties.
The variance effect may matter more than the mean. GRPO cuts run-to-run standard deviation by 42% to 65%. One GRPO evaluation run is a more reliable estimate than one SFT run.
There is also a scale-dependent split in learned strategy. After GRPO, the 350M and 1B models use 87% to 89% search commands and submit more files. The 3B model settles at 52% search and 37% read, and submits fewer files at higher precision. The reward never prescribed either policy.
Deployment
Antares-1B hits 0.209 File F1 on VLoc Bench, above GLM-5.2 at 753B parameters and Gemini 3 Pro.
The Granite 4.0 base checkpoints score approximately 0.000 under the same protocol, so post-training supplies essentially all the capability.
GRPO adds 11-25% File F1 and cuts run-to-run variance 42-65%, which matters more for repeatable CI scans.
A full 500-task sweep costs under $1 on one H100, against $12.50 for GLM-5.2 and $141 for GPT-5.5.
The strongest variant, Antares-3B, is not released, and Antares has no published Phase B false-alarm numbers.
What it means
Developers gain a lightweight option for a specific bottleneck in their workflow. Instead of paying for massive generalist models to find known flaws, they can run a smaller, cheaper model locally. This reduces the cost of initial triage without requiring a full overhaul of their security stack.
Teams should note that the 3B model is unavailable. They also cannot yet see how well the models avoid false alarms on fixed code, as Phase B data is unpublished.
